ICO. 


Information Commissioner’s Office 


Freedom of Information Act 2000 


Definition document for wholly-owned 
companies 


This guidance is written for the use of wholly-owned companies which are 
public authorities for the purpose of the Freedom of Information Act 2000 
(FOIA). It gives examples of the kinds of information that the ICO expects 
you to provide in order to meet your commitments under the model 
publication scheme. 


The ICO expects you to make the information in this definition document 
available unless: 


e you do not hold the information; 

e the information is exempt under FOIA exemptions or 
Environmental Information Regulations 2004 (EIR) exceptions, or 
its release is prohibited under another statute (eg UK GDPR); 

e the information is readily and publicly available from an external 
website. Such information may have been provided by you or on 
your behalf. You must provide a direct link to that information; 

e the information is archived, out of date or otherwise 
inaccessible; or 

e it would be impractical or resource-intensive to prepare the 
material for routine release. 


If the information is held by another public authority, you should provide 
details of where to obtain it. 


This guidance is not meant to give an exhaustive or definitive list of 
everything that should be covered by a publication scheme. The legal 
commitment is to the model publication scheme, and you should look to 
provide as much information as possible on a routine basis, which must 
include all information that is required by statute. 


Publishing datasets for re-use 


As a public authority, you must publish under your publication scheme 
any dataset you hold that has been requested, together with any updated 
versions, unless you are satisfied that it is not appropriate to do so. So far 
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as reasonably practicable, you must publish it in an electronic form that is 
capable of re-use. 


If the dataset or any part of it is a relevant copyright work and you are 
the only owner, you must make it available for re-use under the terms of 
a specified licence. Datasets in which the Crown owns the copyright or the 
database rights are not relevant copyright works. 


The Section 45 Code of Practice 2018 recommends that you make 
datasets available for re-use under the Open Government Licence. The 
term ‘dataset’ is defined in section 11(5) of FOIA. The terms ‘relevant 
copyright work’ and ‘specified licence’ are defined in section 19(8) of 


FOIA. The ICO has published guidance on Datasets (section 11,19 & 45). 


This explains what is meant by “not appropriate” and “capable of re-use”. 


Model publication scheme 


The table below identifies the specific information the ICO expects you to 
publish under each of the seven classes of information set out in the 


model publication scheme. 


Class 1 - Who we are and what we do 
Organisational information, structures, locations and contacts. 
Information in this class should only be current information, unless 
Stated otherwise. 

e Roles and responsibilities 
Provide outline and detailed information about your roles and 
responsibilities, and the roles and responsibilities of people 
working in the company at senior level. Indicate the relationship 
with the public authority or authorities owning the company. 


e Articles of association 


e Board membership 


Identify and include the responsibilities and biographical details 
of board members. Only publish biographical details that are not 
work-related in line with UK GDPR. 
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e Senior executives 


Identify and include the responsibilities and biographical details of 
those making strategic and operational decisions about the 
provision of your services. Only publish biographical details that 
are not work-related in line with UK GDPR. 


e Organisational structure 
e Location and contact details 
Provide your postal and email address. If possible, provide 
named contacts including contact phone numbers and email 
addresses. 
e Gender pay gap reporting 
Read the Government’s guidance on the gender pay gap 


reporting to find out what information you need to publish. Publish 
this data annually if you have a head count of 250 staff or more. 


Class 2 - What we spend and how we spend it 


Financial information relating to projected and actual income and 
expenditure, procurement, contracts and financial audit. 


As a minimum, make available financial information for the 
current and previous financial year. 


e Financial statements, budgets and variance reports 


Provide financial information in enough detail to allow the public to 
see how money is being spent, where you are spending it or are 
planning to spend it, and the difference between the two. 


Provide financial information at least annually and, where practical, 
provide half yearly or quarterly financial reports. Include revenue 
budgets and budgets for capital expenditure. 


e Annual accounts 
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e Expenditure 


Provide details of items of expenditure over £25,000, including 
costs, supplier and transaction information (monthly). 


e Financial audit reports 
e Staff pay and grading structure 


You can provide this as part of your organisational structure. As a 
minimum, include the details of senior staff salaries in bands of 
£5,000. For all other posts, identify levels of pay by salary range. 


The ‘pay multiple’ - the ratio between the highest paid salary and 
the median average salary of the whole of your workforce. 


e Staff and board members’ allowances and expenses 


Provide details of the allowances and expenses that can be incurred 
or claimed. Include the total of the allowances and expenses 
incurred by or paid to individual senior staff and management board 
members by reference to categories. Produce these categories in 
line your policies, practices and procedures under headings like 
travel, subsistence and accommodation. 


e Capital programme 
Provide information on major plans for capital expenditure 
including any private finance initiative and public-private 
partnership contracts. 

e Procurement and tender procedures and reports 
Provide details of procedures used for acquiring goods and 
services, including contracts available for public tender and 
reports of successful tenders. 


e List of contracts awarded and their value 


Publish details of contracts that exceed £25,000. 
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Class 3 - What our priorities are and how we are 
doing 


Strategies and plans, performance indicators, audits, inspections 
and reviews. 
Make information in this class available at least for the current and 


previous three years. 


Strategic and business plans, aims and 
objectives 


Annual report 

Customer surveys 

Data protection impact assessments (in full or 
summary format) or any other impact assessments (eg 


health and safety impact assessments, equality impact 
assessments), as appropriate and relevant 


Class 4 - How we make decisions 
Decision making processes and records of decisions. 

Make available information in this class at least for the current 
and previous two years. 


e Board papers - agenda, supporting papers and 
minutes of meetings 


Make available board minutes and the minutes of similar meetings 
where decisions are made about providing services. Exclude 
material that is properly considered to be exempt from disclosure. 


Class 5 - Our policies and procedures 


Current written protocols, policies and procedures for delivering 
your services and responsibilities. 
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Publish current information only in this class. 
e Policies and procedures for conducting business 


Standing orders, delegated powers, corporate governance, 
code of conduct, memoranda of understanding and similar 
matters. 


e Policies and procedures for delivering your 
services 


Policies that affect the manner in which you provide services. 
Include any policies and procedures for handling requests for 
information. 


e Policies and procedures for recruiting and 
employing staff 


Publish policies such as equality, recruitment, disciplinary and 
grievance. If vacancies are advertised as part of 

recruitment policies, you should make details of current 
vacancies readily available. 


e Equality and diversity policies 


e Equality scheme (if you are subject to section 75 of the 
Northern Ireland Act) 


e Health and safety 


e Customer service and complaints policies and 
procedures 


Standards for providing services to your company’s customers, 
including your complaints procedures. Include complaints 
procedures covering information requests and the operation of the 
publication scheme. 


e Records management, personal data and access to 
information policies 


Include information security policies, file plans, records retention, 
destruction and archive policies, and data protection (including 
data sharing and CCTV usage) policies. 
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e Charging regimes and policies 


Provide details of any statutory charging regimes and include 
charges made for information routinely published. Clearly state 
what costs you are recovering, the basis on which you make 
them, and how you calculated them. 


If you charge a fee for licensing the re-use of datasets, you 
should state in your guide to information how this is calculated 
and whether the charge is made under the Re-use Fees 
Regulations or under other legislation. You cannot charge a re-use 
fee if you make the datasets available for re-use under the Open 
Government Licence. 


Class 6 - Lists and registers 


Include information contained only in currently maintained lists and 
registers. 


e Any lists or registers that you may be required to 
produce in the conduct of your business 


List of main contractors or suppliers 

Asset registers 

Information asset register 

Disclosure logs 
If you produce a disclosure log indicating the information provided 
in response to FOIA and EIR requests, make it readily available. 
Disclosure logs are recommended as good practice. 


e Any register of interests you keep 


e Register of gifts and hospitality provided to board 
members and senior staff 


e Register of people with significant control 
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e CCTV 


Details of the locations of any overt CCTV surveillance cameras 
operated by you or on your behalf. You should decide on the 
level of detail which is appropriate. This could be by building, 
area or more general geographic locations, eg postcodes or 
partial postcodes, depending on the security issues raised. 


Class 7 -— The services we offer 


Information about the services you provide, including leaflets, 
guidance and newsletters. 


Generally, this is an extension of part of the first class of 
information. While the first class provides information on your roles 
and responsibilities, this class includes details of the services you 
provide internationally, nationally and locally as a result of them. 


For example, it will benefit the public to have ready access to 
information about the services you provide for the public and for the 
public authority or authorities owning you, to the information 

readily available to individuals, including in person and online. The 
Starting point would normally be a list or lists of the services you 
are responsible for, linked to details of these services. 


e Details of your services 


Services for which you are entitled to recover a fee, 
together with those fees 


Leaflets 


Corporate communications and media releases 
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